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Data sharing can bring important benefits to organisations, citizens and 
consumers, making our lives easier and helping to deliver efficient 
services. It is important, however, that organisations who share personal 
data have high data protection standards, sharing data in ways that are 
fair, transparent and accountable. We also want controllers to be 
confident when dealing with data sharing matters so individuals can be 
confident their data has been shared securely and responsibly. 


As required by the Data Protection 2018, we are working on updating our 
data sharing code of practice, which was published in 2011. The updated 
code will explain and advise on changes to data protection legislation 
where these changes are relevant to data sharing. It will address many 
aspects of the new legislation including transparency, lawful bases for 
processing, the new accountability principle and the requirement to record 
processing activities. 


The updated data sharing code of practice will continue to provide 
practical guidance in relation to data sharing and will promote good 
practice in the sharing of personal data. In the first instance we will 
address the impact of the changes in data protection legislation on data 
sharing and will then move on to developing further case studies. Our 
intention is that, as well as legislative changes, the code will also deal 
with technical and other developments that have had an impact on data 
sharing since the publication of the last code in 2011. 


Before preparation of the code the Information Commissioner must 
consult with the Secretary of State. She is also seeking input from trade 
associations, data subjects and those representing the interests of data 
subjects. This call for views is the first stage of the consultation process. 
We will use the responses we receive to inform our work in developing the 
updated code. 


You can email your response to 


© 
CentralGovernment@ICO.org.uk 1C 0O. 


Information Commissioner's Office 


Or print and post to: 


Data Sharing Code Call for Evidence 
Central Government Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the call for evidence, please email 
the Central Government team. 


Please send us your views by 10 September 2018. 


Privacy statement 


For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 


Questions 


Qi We intend to revise the code to address the impact of changes in 
data protection legislation, where these changes are relevant to 
data sharing. What changes to the data protection legislation do 
you think we should focus on when updating the code? 


The key changes in the data protection legislation that impact on data sharing 
include the increased emphasis on transparency and the changes in lawful 
grounds for processing personal data. These are key points that need additional 
explanation and revision. 


Additionally the new requirements around governance and documentation mean 


that this should also be a key area for additional guidance. 


jabilities on both controllers and processors also has import on data sharing 
agreements and clear guidance should be provided on (a) data sharing between 
“joint” data controllers for the same purposes (b) between controllers for 


different purposes and (c) between controllers and processors should be 
explored in detail and would be helpful for industry including the research sector. 
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Q2 Apart from recent changes to data protection legislation, are there 
other developments that are having an impact on your 
organisation’s data sharing practice that you would like us to 
address in the updated code? 


[| vV Yes 
[| No 


Q3 If yes (please specify) 


The Digital Economy Act 2017 and the data sharing codes and regulations such 
as the Research Code of Practice and Accreditation criteria set out how to access 
to public authority data for research purposes. 


The relationship between these Codes and the ICO Data Sharing Code of Practice 
ust be made clear. In particular it is important that there is consistency and 


guidance on the approach to be taken if there is inconsistency in recommended 
or required approaches and if necessary, amendments made to other codes to 
eflect ICO best practice. 


Q4 


i 


Does the 2011 data sharing code of practice strike the right 
balance between recognising the benefits of sharing personal data 
and the need to protect it? Please give details. 


Yes 
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Q5 If yes in what ways does it achieve this? 


Q6 If no, in what ways does it fail to strike the right balance? 


Code sets out clear criteria to consider for data sharing but as is to be expected 
does not make a strong policy argument for benefits of data sharing to 
individuals and society. It would be useful if case studies were included that 
demonstrated wider societal benefits of sharing data, recognising that 
easonable expectations of individuals must always be considered. In particular 
it is important to highlight the issues of use of big data sets and newer forms of 


data and issues in data sharing such as the role of trusted third parties and 
ombination or linkage of datasets. 
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Q7 What types of data sharing (eg systematic, routine sharing or 
exceptional, ad hoc requests) are covered in too much detail in the 
2011 code? 


ncreased collaboration and data sharing between the public and private sectors 
in light of fact there are often mutual benefits in ensuring quality data is 
available for ethical scientific research is an area that could be covered. 


Q8 What types of data sharing (eg systematic, routine sharing or 
exceptional, ad hoc requests) are not covered in enough detail in 
the 2011 code? 
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Q9 Is the 2011 code relevant to the types of data sharing your 
organisation is involved in? If not, which additional areas should 
we cover? 


Q10 Please provide details of any case studies or data sharing scenarios 
that you would like to see included in the updated code? 


haring of administrative data for research sector and link between data sharing 
approaches including those outside ambit of Data Sharing Research Accreditation 
Code. 
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Q11 Is there anything the 2011 code does not cover that you think it 
should? Please provide details. 


Interaction between requirements of sector Codes approved under GDPR 
and Data Code of Sharing 


Sharing within organisations, multi-jurisdictions 


Additional considerations for sharing that involves transfers to third 
countries and between UK and EU countries post UK withdrawal from the 
EU. 


Q12 In what other ways do you think the 2011 code could be 
improved? 


oO 
ICO. 

About you: 

Q13 Are you answering these questions as? 

A public sector worker 

A private sector worker 

A third or voluntary sector worker 

A member of the public 

A representative of a trade association 

A data subject 

An ICO employee 

Other 
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14 If other please specify: 


Q15 Please provide more information about the type of organisation 
you work for, ie a bank, a housing association, a school. 


The Market Research Society (MRS) is the world’s largest research association. 
It’s for everyone with professional equity in market, social and opinion research 


and in business intelligence, market analysis, customer insight and consultancy. 


The UK is the second largest research market in the world (second to the US) and 
the UK research sector is recognised as leading the way in the development of 
creative and innovative research approaches. MRS supports best practice by 


setting and enforcing industry standards. 


Q16 We may want to contact you about some of the points you have 
raised. If you are happy for us to do this please provide your email 


address: 


—— O 0 2:1.2: 225221ch Society 


Thank you for taking the time to share your views and experience. 


